myip
🇬🇧 EN

IP subnet calculator

IPv4 and IPv6. Everything is calculated in your browser — nothing is sent to us.

For IPv6 there is no broadcast address, and the whole prefix is usable.

What the slash actually means

Everything on this page follows from one idea. An address is a string of bits — 32 of them in IPv4, 128 in IPv6 — and a prefix length says how many of those bits identify the network. Whatever is left identifies a host inside it. In 192.168.1.10/24 the first 24 bits are the network and the last 8 are the host, which is why that network holds 256 addresses and why every address from 192.168.1.0 to 192.168.1.255 belongs to it.

This notation replaced the old system of address classes in 1993, and the class system is worth mentioning only because its vocabulary survives in places it should not. There is no such thing as a "class C network" any more; there are prefixes, and a prefix can be any length. The persistence of the habit is why so many people assume every network is a /24 and are then surprised by a /22.

Two things follow immediately, and they explain most subnetting mistakes:

The fields, and what each one is good for

Network address
The first address in the block, with all host bits zero. It names the network rather than any machine on it, which is why it is not assigned to a device on ordinary IPv4 subnets.
Netmask and wildcard mask
Two ways of writing the same prefix. The netmask (255.255.255.0) is what an operating system asks for; the wildcard mask (0.0.0.255) is its bitwise inverse and is what Cisco access lists and some routing configurations expect. Confusing the two produces a rule that silently matches the wrong traffic — which is worse than a rule that fails.
Broadcast address
The last address, all host bits set. Traffic sent to it goes to every host on the segment. It exists in IPv4 only; IPv6 removed broadcast entirely and uses multicast groups instead.
First and last usable host
The range you can actually assign — everything between network and broadcast. In practice one more is taken by the router, so the count of addresses available to your machines is usually two fewer than the arithmetic suggests, then one fewer again.
Host count
2 raised to the number of host bits, minus the network and broadcast addresses. The subtraction is where the exceptions live, immediately below.
Binary form
Worth looking at once. Seeing the prefix boundary land inside an octet is what makes subnetting stop being a memorised table and start being obvious.

The two exceptions to "minus two"

A /31 has no usable hosts at all by the standard arithmetic — two addresses, both consumed by network and broadcast. Since 2000 it has nevertheless been legitimate and normal to use a /31 on a point-to-point link between two routers, where both addresses are assigned and the concepts of network and broadcast are meaningless because there are exactly two participants. This saves two addresses per link, which across a large network is a substantial amount of increasingly expensive IPv4 space.

A /32 is a single address: one host, no network, no broadcast. You will meet it as a loopback address on a router, in a firewall rule that matches exactly one machine, and in routing tables as the most specific possible route.

Ranges you should recognise on sight

10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16
Private space. Reusable inside any network, never routed across the internet. Note the middle one carefully: it is 172.16 through 172.31, not all of 172.x — a boundary that has caused a great many accidental collisions.
100.64.0.0/10
Shared address space for carrier-grade NAT. If your router reports an address in this range on its outside interface, you are behind your provider's NAT and no incoming connection will reach you — which is the answer to a large share of "why can I not open a port" questions.
169.254.0.0/16
Link-local, self-assigned when DHCP fails. An address here almost always means "I could not reach a DHCP server", and diagnosing anything else before fixing that is wasted effort.
127.0.0.0/8
Loopback. The whole block, not just 127.0.0.1 — the entire range never leaves the machine.
192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24
Reserved for documentation and examples. Use these when writing instructions instead of inventing an address that belongs to somebody real.

Splitting a network without making a mess

Dividing a block is the calculator's main job. Each extra prefix bit halves the network: a /24 becomes two /25s, four /26s, eight /27s. The rule that keeps the result sane is that every subnet must start on its own boundary — a /26 at a multiple of 64, a /28 at a multiple of 16.

Where people go wrong is sizing. Allocate for what a segment will hold in a few years, not what it holds today, but resist the reflex of giving everything a /24 because it is familiar: a point-to-point link needs two addresses, a management network for a dozen switches does not need 254, and space handed out generously at the start is what forces a painful renumbering later. Use variable sizes deliberately — a /30 or /31 for links, a /28 for a small server segment, a /24 where users actually live.

And check for overlap before you commit. Two subnets overlap whenever the shorter prefix contains the longer one, which is easy to miss when the numbers are written in decimal and obvious the moment you look at the binary form. An overlap does not announce itself; it produces traffic that reaches its destination sometimes.

IPv6 arithmetic is a different habit

The mathematics is identical and the instincts are not, because IPv6 removes the reason to be frugal. The rules that matter in practice:

Once a network is planned, the useful next step is checking that it actually works over both protocols — that is what the IPv6 test answers from a client's point of view, and what a DNS lookup tells you about whether names publish the AAAA records to make it reachable at all.

Nothing you type here leaves your browser

The arithmetic runs entirely in JavaScript on your own machine. There is no form submission, no request to us, and nothing in our logs: we do not know which prefixes you calculated. This is not a privacy policy so much as a description of the mechanism — the page could not send us your internal addressing plan even if we wanted it, and once loaded it works with the network disconnected.

Frequently asked questions

What does the number after the slash mean?

It is how many bits at the start of the address identify the network; the rest identify a host inside it. In 192.168.1.10/24 the first 24 bits are the network, leaving 8 bits and therefore 256 addresses. The counter-intuitive part is that a larger number means a smaller network — a /25 is half of a /24, not twice it.

Why is the number of usable hosts two fewer than the total?

Because the first address in an IPv4 block names the network itself and the last is the broadcast address for the segment, so neither can be given to a machine. In practice a third is taken by the router, so a /24 with 256 addresses gives you 253 for actual devices. IPv6 has no broadcast address, so the subtraction does not apply there at all.

Can I really use a /31 for a link between two routers?

Yes, and it is standard practice. On a point-to-point link there are exactly two participants, so the concepts of network and broadcast address have nothing to describe and both addresses can be assigned. It has been legitimate since 2000 and saves two addresses on every link, which adds up quickly across a large network now that IPv4 space is expensive.

What is a wildcard mask and how does it differ from a netmask?

It is the bitwise inverse of the netmask: 255.255.255.0 becomes 0.0.0.255. Operating systems want the netmask; Cisco access lists and some routing configurations want the wildcard. The reason to be careful is the failure mode — swapping them does not produce an error message, it produces a rule that quietly matches the wrong range of addresses.

Why does the calculator say my network address is different from what I typed?

Because a prefix must start on its own boundary. A /26 covers 64 addresses and can only begin at a multiple of 64, so 192.168.1.50/26 is not a network — it is a host inside 192.168.1.0/26. The calculator shows the block the address actually belongs to, which is usually what you meant.

My router shows an address starting with 100.64. Is that private?

It is shared address space used for carrier-grade NAT, so in effect yes: you are behind your provider's translation rather than holding a public address. The practical consequence is that incoming connections cannot reach you, which makes port forwarding, hosting anything and some peer-to-peer applications impossible until the provider gives you a public address, usually on request or for a fee.

Why is a /64 always used for an IPv6 subnet?

Because automatic address configuration is built around a 64-bit interface identifier, so a longer prefix on a normal network segment breaks it. There is also no reason to economise: a single /64 contains about 18 quintillion addresses, and a site typically receives a /48 or /56 from its provider, which is thousands of /64 subnets to allocate internally.

Do the addresses I enter get sent to your server?

No. The whole calculation runs in JavaScript in your browser, so nothing is submitted and nothing appears in our logs — we do not know which prefixes you worked on. Once the page has loaded it keeps working with the network disconnected, which is a reasonable way to verify the claim for yourself.

Related checks